GPT-5.4

Very strong domain performance at 97.8 across 6 tasks, with no notable weaknesses. The model handled file upload, hostname allowlisting, HTML encoding, redirect building, and URL sanitization consistently.

Good but uneven at 79.4: cookie policy, CSRF, JWT, refresh rotation, and fixation detection were strong, but OAuth state validation failed with undefined-length TypeErrors and password strength scoring drifted on nuanced pattern detection. The failures suggest brittle parsing and inconsistent rubric alignment on password feedback.

Excellent at 98.4 with all five tasks strong, including ABAC, API key scope, permission checks, and tenant isolation. This is the most reliable area of the model, with no visible edge-case regressions.

Moderate at 78.7, with strong static-analysis style tasks but weaker dynamic detection tasks. Auth log anomaly detection missed or over-added indicators, secret detection had both false negatives and partial extraction issues, and SSRF detection failed hard by classifying valid URLs as invalid.

The single task scored well enough to land at 87.8, but the sample size is too small to trust as a stable signal. No obvious weakness is visible from the provided result.

Weakest domain at 56.0, driven by a brittle crypto utility implementation that appears to assume string inputs and crashes on non-string values. The encryption pipeline was strong, but the utility task failed with TypeErrors and empty outputs, indicating poor defensive handling.